VPNs can route user traffic to a remote server through an encrypted connection, preventing intermediaries from reading the content and target servers from seeing the user’s IP address. However, in single-server systems, the traffic is decrypted before being sent to the destination; during this process, the traffic and the sender’s and destination IP addresses may be visible to malicious employees or attackers. The failure to encrypt certain metadata, such as timestamps, may also enable governments to create user profiles. Although U.S. agencies recommend using VPNs, they have not provided criteria for which configurations offer sufficient protection.
In a letter sent Wednesday to NSA Director Gen. Joshua Rudd, Sen. Ron Wyden (D-Ore.) requested clear recommendations for government employees, defense contractors, journalists and human rights defenders facing sophisticated foreign threats. Wyden asked the NSA to update its existing public guidance and provide its responses by October 14. The questions include the adequacy of standard single-hop commercial VPNs, comparisons with multi-hop systems such as Apple Private Relay, Tor and Nym, and the necessity of random delays, cryptographic padding and cover traffic.
Nym is an open-source client written in Rust; it supports random delays and message reordering over a decentralized mixnet, as well as multiple hops. Apple Private Relay uses two servers, one operated by Apple and the other by a third-party content provider, and its protection is limited to Safari on Apple devices. Tor, meanwhile, routes traffic through three servers. Spies may be among the volunteer operators on Nym and Tor, while Private Relay relies on companies such as Cloudflare and Akamai. Although the Congressional Research Service summarizes the options, it does not provide selection criteria. Georgetown University professor Micah Sherr noted that there is no reliable standardization for evaluating VPN services.
Why it matters
The request shows that presenting VPN use as a general security measure may not be sufficient for users facing serious threats. For government employees, defense contractors, journalists and human rights defenders, the key issue is not so much whether the connection is encrypted as who can see traffic patterns and metadata. The differences between single-hop services and multi-hop or mixnet-based options also raise the question of how much protection depends on the device, browser and service providers being used. However, existing guidance does not specify under which threat model these options should be preferred. The NSA’s response leaves open the question of whether it will turn technical features into a concrete evaluation framework that users can use to compare them.
Term: latency
Latency is the time between sending a request and receiving the response; it is directly noticeable in gaming and live streaming.